{"id":"CVE-2026-15793","summary":"Git source checkout from a bundle file could lead to command injection","details":"BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.","aliases":["GHSA-hw3h-2gp9-cxpv"],"modified":"2026-08-12T03:51:32.252716179Z","published":"2026-07-21T16:10:21.790Z","database_specific":{"cna_assigner":"Docker","cwe_ids":["CWE-88"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15793.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15793.json"},{"type":"ADVISORY","url":"https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15793"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/moby/buildkit","events":[{"introduced":"dd2170e156c9633da1b2d1a58a6188e3f7d36fa4"},{"fixed":"e42e1bfd389af7203238cce77b1f7dad447285e9"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.30.0"},{"last_affected":"0.31.1"},{"fixed":"0.31.2"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15793.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}